diff --git a/extraconfig/tasks/swift-ring-deploy.yaml b/extraconfig/tasks/swift-ring-deploy.yaml
new file mode 100644
index 0000000000..b61310b4ad
--- /dev/null
+++ b/extraconfig/tasks/swift-ring-deploy.yaml
@@ -0,0 +1,31 @@
+heat_template_version: newton
+
+parameters:
+  servers:
+    type: json
+  SwiftRingGetTempurl:
+    default: ''
+    description: A temporary Swift URL to download rings from.
+    type: string
+
+resources:
+  SwiftRingDeployConfig:
+    type: OS::Heat::SoftwareConfig
+    properties:
+      group: script
+      inputs:
+        - name: swift_ring_get_tempurl
+      config: |
+        #!/bin/sh
+        pushd /
+        curl --insecure --silent "${swift_ring_get_tempurl}" | tar xz || true
+        popd
+
+  SwiftRingDeploy:
+    type: OS::Heat::SoftwareDeployments
+    properties:
+      name: SwiftRingDeploy
+      config: {get_resource: SwiftRingDeployConfig}
+      servers:  {get_param: servers}
+      input_values:
+        swift_ring_get_tempurl: {get_param: SwiftRingGetTempurl}
diff --git a/extraconfig/tasks/swift-ring-update.yaml b/extraconfig/tasks/swift-ring-update.yaml
new file mode 100644
index 0000000000..b6a4183ac5
--- /dev/null
+++ b/extraconfig/tasks/swift-ring-update.yaml
@@ -0,0 +1,42 @@
+heat_template_version: newton
+
+parameters:
+  servers:
+    type: json
+  SwiftRingPutTempurl:
+    default: ''
+    description: A temporary Swift URL to upload rings to.
+    type: string
+
+resources:
+  SwiftRingUpdateConfig:
+    type: OS::Heat::SoftwareConfig
+    properties:
+      group: script
+      inputs:
+        - name: swift_ring_put_tempurl
+      config: |
+        #!/bin/sh
+        TMP_DATA=$(mktemp -d)
+        function cleanup {
+          rm -Rf "$TMP_DATA"
+        }
+        trap cleanup EXIT
+        # sanity check in case rings are not consistent within cluster
+        swift-recon --md5 | grep -q "doesn't match" && exit 1
+        pushd ${TMP_DATA}
+        tar -cvzf swift-rings.tar.gz /etc/swift/*.builder /etc/swift/*.ring.gz /etc/swift/backups/*
+        resp=`curl --insecure --silent -X PUT "${swift_ring_put_tempurl}" --write-out "%{http_code}" --data-binary @swift-rings.tar.gz`
+        popd
+        if [ "$resp" != "201" ]; then
+            exit 1
+        fi
+
+  SwiftRingUpdate:
+    type: OS::Heat::SoftwareDeployments
+    properties:
+      name: SwiftRingUpdate
+      config: {get_resource: SwiftRingUpdateConfig}
+      servers: {get_param: servers}
+      input_values:
+        swift_ring_put_tempurl: {get_param: SwiftRingPutTempurl}
diff --git a/overcloud-resource-registry-puppet.j2.yaml b/overcloud-resource-registry-puppet.j2.yaml
index 96ae70b082..c46668a42a 100644
--- a/overcloud-resource-registry-puppet.j2.yaml
+++ b/overcloud-resource-registry-puppet.j2.yaml
@@ -10,6 +10,9 @@ resource_registry:
   OS::TripleO::Tasks::UpdateWorkflow: OS::Heat::None
   OS::TripleO::Tasks::PackageUpdate: extraconfig/tasks/yum_update.yaml
 
+  OS::TripleO::Tasks::SwiftRingDeploy: extraconfig/tasks/swift-ring-deploy.yaml
+  OS::TripleO::Tasks::SwiftRingUpdate: extraconfig/tasks/swift-ring-update.yaml
+
 {% for role in roles %}
   OS::TripleO::{{role.name}}PostDeploySteps: puppet/post.yaml
   OS::TripleO::{{role.name}}: puppet/{{role.name.lower()}}-role.yaml
diff --git a/puppet/post.j2.yaml b/puppet/post.j2.yaml
index 6ee1af2e88..cfac5b5e99 100644
--- a/puppet/post.j2.yaml
+++ b/puppet/post.j2.yaml
@@ -56,6 +56,13 @@ resources:
         update_identifier: {get_param: DeployIdentifier}
   {% endif %}
 
+  {% if role.name in ['Controller', 'ObjectStorage'] %}
+  {{role.name}}SwiftRingDeploy:
+    type: OS::TripleO::Tasks::SwiftRingDeploy
+    properties:
+      servers: {get_param: [servers, {{role.name}}]}
+  {% endif %}
+
   # Step through a series of configuration steps
   {{role.name}}Deployment_Step1:
     type: OS::Heat::StructuredDeploymentGroup
@@ -161,4 +168,14 @@ resources:
         update_identifier: {get_param: DeployIdentifier}
   {% endif %}
 
+  {% if role.name in ['Controller', 'ObjectStorage'] %}
+  {{role.name}}SwiftRingUpdate:
+    type: OS::TripleO::Tasks::SwiftRingUpdate
+    depends_on:
+  {% for dep in roles %}
+      - {{dep.name}}Deployment_Step5
+  {% endfor %}
+    properties:
+      servers: {get_param: [servers, {{role.name}}]}
+  {% endif %}
 {% endfor %}